Privacy Policy

Who we are

Backroad Hooligan sells sunglasses online at backroadhooligan.com. This policy explains what personal information we collect, why, who it goes to, and the choices you have.

It’s written to meet New Zealand’s Privacy Act 2020, Australia’s Privacy Act 1988 and the Australian Privacy Principles, and US state privacy laws including California’s (CCPA, as amended by the CPRA).

What we collect

• When you order: your name, email, phone number, shipping and billing address, and what you bought. Payment is handled by Stripe; your card number never reaches us.
• When you contact us or report a problem: your message, your order number and any photos you send.
• If you join the newsletter: your email address and the country you signed up from.
• If you create an account: your sign-in email, saved address and wishlist.
• As you browse: the pages and products you look at, what you add to your cart, your approximate country, the type of device, and the site or campaign that sent you. We record this ourselves, against a random session ID rather than your name.
• If we run Meta (Facebook and Instagram) ads, Meta’s pixel may set cookies to measure them. See “Advertising” below.

How we use it

• To take payment, pass your order to our fulfillment partner and get it delivered.
• To send emails about your order: confirmation, shipping and tracking, and replies to anything you raise. These aren’t marketing and you’ll get them regardless.
• To sort out returns, refunds, lost parcels and faults.
• To prevent fraud and keep the store secure.
• To send the newsletter, only if you opted in.
• To understand what’s working in the store and in our ads, in aggregate.
• To keep the records tax and accounting laws require.

Who we share it with

Only with the services that run the store for us, and only what each needs:

• Stripe, to process payments.
• CJdropshipping, our fulfillment partner, which packs and ships orders. It receives your name, delivery address, phone number and email so the parcel can reach you.
• Postal services and couriers, to deliver your order.
• Supabase (database), Vercel (website hosting) and Resend (email sending).
• Meta, if we run ads with its pixel (see below), and Google, which lists our products in search.

We don’t sell personal information, and we don’t let anyone use it for their own purposes. We’ll disclose information if the law requires it.

Our mailing list

If you join the mailing list, your email address is used for one thing: sending you our emails. We never sell, rent, trade or share it with advertisers, data brokers or anyone else for their own use. Signing up doesn’t send it to Meta, Google or any other ad platform.

It’s kept in our database (Supabase) and sent through our email provider (Resend), and goes nowhere else. Every email has a one-click unsubscribe link, and once you’re off, you stay off.

Advertising and cookies

The store uses a few things your browser stores: your cart, your currency choice and, if you have one, your sign-in. These are needed for the store to work.

If we run Meta ads, Meta’s pixel sets cookies that let us measure which ads lead to sales. When you buy, we tell Meta about the purchase, with your contact details in scrambled (hashed) form so it can match the sale to an ad. Under some US state laws this counts as “sharing” for targeted advertising. You can opt out by turning on Global Privacy Control in your browser (we honor it: the pixel doesn’t load) or by contacting us. You can also clear or block cookies in your browser settings.

Where it’s stored

Our service providers store and process information in the United States, South Korea (our database) and, for fulfillment, China and the countries our partner ships from. That means it may leave New Zealand, Australia or the US. We use providers that protect it to standards comparable to the laws above.

How long we keep it

• Order records: up to 7 years, because tax and accounting laws require it.
• Messages and requests: up to 2 years after they’re resolved.
• Newsletter: until you unsubscribe. We keep a record that you unsubscribed so you aren’t added back by mistake.
• Browsing data: up to 26 months.

Your rights

You can ask to see the personal information we hold about you, have it corrected, or have it deleted (except what we must keep by law). You can unsubscribe from marketing at any time with the link in every newsletter.

• US residents, including in California, Colorado, Connecticut, Virginia and other states with privacy laws: you have the right to know, access, correct and delete your information, and to opt out of its sale or sharing for targeted advertising. We don’t sell it. We won’t treat you differently for using these rights. You can use an authorized agent.
• New Zealand: if you’re unhappy with how we’ve handled your information, you can complain to the Privacy Commissioner (privacy.org.nz).
• Australia: you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

To make a request, use the contact form at backroadhooligan.com/contact. We’ll confirm it’s you by checking the request comes from the email on the order, and we’ll respond within 30 days.

Security

The site runs over HTTPS, payments go through Stripe (which is PCI DSS certified), and access to customer information is limited to the people who run the store. No system is perfectly secure, but we take reasonable steps to protect what we hold.

Children

The store isn’t aimed at children under 16 and we don’t knowingly collect their information.

Changes

If we change this policy, we’ll update it here and change the date at the top. Significant changes will be flagged on the site.

Contact

Questions about privacy? Use the contact form at backroadhooligan.com/contact.